# US 12,007,774 B2 · System and method for guidance integrity monitoring for low-integrity modules > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,007,774 B2 - Document ID: US12007774B2 - Status: Granted - Kind: B2 - Application number: 17/704,838 - Filed: 2022-03-25 - Published: 2023-09-28 - Granted: 2024-06-11 - Earliest claimed: 2022-03-25 - Assignees: Rockwell Collins, Inc. - Applicants: Rockwell Collins, Inc. - Inventors: Bryan M. Krawiec; Daniel K. Papke; Jason J. Jakusz; Angus L McLean - Web page: https://patentgrep.com/patent/US12007774B2 ## CPC - G05D 1/0055: {with safety arrangements} - G05D 1/0214: {in accordance with safety or protection criteria, e.g. avoiding hazardous areas (monitoring the location of vehicles within a certain area, e.g. forbidden or allowed areas, in traffic control systems for road vehicles G08G1/13)} - B60W 60/0015: {specially adapted for safety} - B60W 60/007: {Emergency override (Handing over between remote control and on-board control or handing over between remote control arrangements G05D1/227)} - G05D 1/0088: {characterized by the autonomous decision making process, e.g. artificial intelligence, predefined behaviours (using knowledge based models G06N5/00)} - G05D 1/0219: {ensuring the processing of the whole working surface} - G05D 1/08: Control of attitude, i.e. control of roll, pitch, or yaw - G05D 1/227: Handing over between remote control and on-board control; Handing over between remote control arrangements - G05D 1/48: Control of altitude or depth - G05D 1/617: Safety or protection, e.g. defining protection zones around obstacles or avoiding hazards (arrangements for controlling the position or course of two or more vehicles for avoiding collisions therebetween G05D1/693; arrangements for reacting to or preventing system or operator failure G05D1/80) - G05D 1/648: Performing a task within a working area or space, e.g. cleaning - B60W 2050/0006: {Digital architecture hierarchy} - G05D: SYSTEMS FOR CONTROLLING OR REGULATING NON-ELECTRIC VARIABLES - B60W: CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT ## Abstract A system and method for integrity monitoring generates primary control output via a primary module. The primary control output is configured to be used to control an autonomous vehicle (AV). The system and method receive situational data comprising AV data and environmental data. The system and method generate, using a monitor module configured to monitor the AV, a set of fallback actions based on at least the situational data. The system and method generate, using the monitor module, a fallback status based on at least the set of fallback actions, where the fallback status is configured to correspond to a determination of whether to override the primary control output. ## Claims ### Claim 1 A system for integrity monitoring, the system comprising: one or more controllers including one or more processors configured to execute a set of program instructions stored in a memory, the set of program instructions configured to cause the one or more processors to: generate primary control output via a primary module, the primary control output configured to be used to control an autonomous vehicle (AV); receive situational data comprising AV data and environmental data; generate, using a monitor module configured to monitor the AV, a set of fallback actions based on at least the situational data; and generate, using the monitor module, a fallback status based on at least the set of fallback actions, wherein the fallback status is configured to correspond to a determination of whether to override the primary control output, wherein the monitor module comprises one or more sub-monitors, wherein each fallback action of the set of fallback actions comprises one or more safety margin data, wherein each of the one or more safety margin data for the each fallback action is based on at least the situational data and the each fallback action, and is generated via a sub-monitor of the one or more sub-monitors. ### Claim 2 (depends on 1) The system of claim 1, the set of program instructions further configured to cause the one or more processors to control the AV based on at least the fallback status. ### Claim 3 (depends on 2) The system of claim 2, the control the AV further based on at least a safe guidance control output of the monitor module, the safe guidance control output based on at least the set of fallback actions and the situational data. ### Claim 4 (depends on 1) The system of claim 1, wherein the one or more safety margin data is indicative of at least one of: a remaining safety margin distance within which a controlled action is determined to be able to be completed by the AV, the controlled action corresponding to the each fallback action; a remaining safety margin time within which the controlled action is determined to be able to be completed by the AV; or a likelihood of the AV being able to successfully and/or safely complete the controlled action at a given time. ### Claim 5 (depends on 4) The system of claim 4, wherein the one or more sub-monitors are configured to normalize the one or more safety margin data such that any one of the one or more safety margin data may be uniformly compared to any other one of the one or more safety margin data. ### Claim 6 (depends on 5) The system of claim 5, wherein the one or more sub-monitors comprise one or more geometry monitors, wherein each geometry monitor of the one or more geometry monitors is configured to generate one or more geometry safety margin data of the one or more safety margin data, wherein the one or more geometry monitors comprise at least one of: a peer avoidance geometry monitor; a keep-in geofencing geometry monitor; a keep-out geofencing geometry monitor; or a terrain avoidance geometry monitor. ### Claim 7 (depends on 1) The system of claim 1, wherein the one or more sub-monitors are configured to be provably and/or exhaustively testable. ### Claim 8 (depends on 1) The system of claim 1, wherein the primary control output comprises at least one of waypoints, guidance commands, or inner loop commands, wherein the guidance commands include at least one of airspeed, heading, altitude, or vertical speed, wherein the inner loop commands include at least one of pitch or bank. ### Claim 9 (depends on 1) The system of claim 1, wherein at least one of the set of fallback actions comprises at least one of: a turn circle, a Bezier curve, or a timeseries of guidance commands. ### Claim 10 A method for integrity monitoring, the method comprising: generating primary control output via a primary module, the primary control output configured to be used to control an autonomous vehicle (AV); receiving situational data comprising AV data and environmental data; generating, using a monitor module configured to monitor the AV, a set of fallback actions based on at least the situational data; and generating, using the monitor module, a fallback status based on at least the set of fallback actions, wherein the fallback status is configured to correspond to a determination of whether to override the primary control output, wherein the monitor module comprises one or more sub-monitors, wherein each fallback action of the set of fallback actions comprises one or more safety margin data, wherein each of the one or more safety margin data for the each fallback action is based on at least the situational data and the each fallback action, and is generated via a sub-monitor of the one or more sub-monitors. ### Claim 11 (depends on 10) The method of claim 10, the method further comprising controlling the AV based on at least the fallback status. ### Claim 12 (depends on 11) The method of claim 11, the controlling the AV further based on at least a safe guidance control output of the monitor module, the safe guidance control output based on at least the set of fallback actions and the situational data. ### Claim 13 (depends on 10) The method of claim 10, wherein the one or more safety margin data is indicative of at least one of: a remaining safety margin distance within which a controlled action is determined to be able to be completed by the AV, the controlled action corresponding to the each fallback action; a remaining safety margin time within which the controlled action is determined to be able to be completed by the AV; or a likelihood of the AV being able to successfully and/or safely complete the controlled action at a given time. ### Claim 14 (depends on 13) The method of claim 13, wherein the one or more sub-monitors are configured to normalize the one or more safety margin data such that any one of the one or more safety margin data may be uniformly compared to any other one of the one or more safety margin data. ### Claim 15 (depends on 14) The method of claim 14, wherein the one or more sub-monitors comprise one or more geometry monitors, wherein each geometry monitor of the one or more geometry monitors is configured to generate one or more geometry safety margin data of the one or more safety margin data, wherein the one or more geometry monitors comprise at least one of: a peer avoidance geometry monitor; a keep-in geofencing geometry monitor; a keep-out geofencing geometry monitor; or a terrain avoidance geometry monitor. ### Claim 16 (depends on 10) The method of claim 10, wherein the one or more sub-monitors are configured to be provably and/or exhaustively testable. ### Claim 17 (depends on 10) The method of claim 10, wherein the primary control output comprises at least one of waypoints, guidance commands, or inner loop commands, wherein the guidance commands include at least one of airspeed, heading, altitude, or vertical speed, wherein the inner loop commands include at least one of pitch or bank. ### Claim 18 (depends on 10) The method of claim 10, wherein at least one of the set of fallback actions comprises at least one of: a turn circle, a Bezier curve, or a timeseries of guidance commands.